Implement A2A Server
Creates a compliant A2A server for managing JSON-RPC 2.0 requests and task lifecycles, enabling multi-agent workflows.
Install this skill
Security score
The Implement A2A Server skill was audited on Mar 3, 2026 and we found 18 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 98 | error: { code: -32601, message: `Method not found: ${request.method}` }, |
Template literal with variable interpolation in command context
| 242 | error: { code: -32001, message: `Task not found: ${taskId}` }, |
Template literal with variable interpolation in command context
| 337 | res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`); |
Curl to non-GitHub URL
| 413 | curl -s http://localhost:3000/.well-known/agent.json | python3 -m json.tool |
Curl to non-GitHub URL
| 416 | curl -X POST http://localhost:3000/ \ |
Webhook reference - potential data exfiltration
| 38 | - **Optional**: Push notification webhook support (`true` or `false`) |
Webhook reference - potential data exfiltration
| 370 | ### Step 5: Add Push Notification Webhook Support |
Webhook reference - potential data exfiltration
| 372 | 5.1. If `pushNotifications` is enabled in the Agent Card, implement webhook registration via `tasks/pushNotification/set`: |
Webhook reference - potential data exfiltration
| 374 | - Validate the webhook URL uses HTTPS; reject with error code `-32004` otherwise |
Webhook reference - potential data exfiltration
| 377 | 5.2. Send webhook callbacks on task state changes: |
Webhook reference - potential data exfiltration
| 379 | - POST a JSON payload with `taskId`, `eventType`, `status`, and `timestamp` to the webhook URL |
Webhook reference - potential data exfiltration
| 382 | 5.3. Implement retry logic for failed webhooks (exponential backoff, max 3 retries). |
Webhook reference - potential data exfiltration
| 386 | **Expected:** Webhook registration and delivery with retry logic. |
Webhook reference - potential data exfiltration
| 388 | **On failure:** Push notification failures must never affect task execution. Log errors and continue. If the webhook URL is persistently unreachable, remove the subscription after max retries. |
Webhook reference - potential data exfiltration
| 395 | - Throw at startup if the card advertises `pushNotifications: true` but webhooks are not enabled |
Webhook reference - potential data exfiltration
| 432 | - [ ] Push notifications deliver webhooks on state changes (if enabled) |
External URL reference
| 413 | curl -s http://localhost:3000/.well-known/agent.json | python3 -m json.tool |
External URL reference
| 416 | curl -X POST http://localhost:3000/ \ |